By clicking on the green eye button placed at the end of each result, is shown the message detail page. The message detail page has a general email data section and 5 additional sections containing advanced information. All the sections will be explored in depth below.
In the first section are shown the message basic information and the message badges. The first badge represents the scan result, the second one represents the last action the Email Security performed on the message (quarantined, delivered, deferred etc...).
- Subject (as section title)
- From (the email address where the email is from)
- Date (the date when the email landed on the appliance)
- To (the email address to the email should be delivered)
- Risk Confidence (a security estimation such as phishing, malware, business compromise emails etc...)
- Spam Confidence (a junk estimation such as spam, newsletter emails etc...)
You can perform many operations to the message you are analysing:
- Add to Welcomelist (you can choose between the sender IP address or the sender email address)
- Add to Blocklist (you can choose between the sender IP address or the sender email address)
- Rescan (put the message in the scanning queue of the appliance aiming to get a different scanning result, in case of changed appliance settings)
- Release (or Release to (specified address(es)) by clicking on the arrow to the right on the button
- Delete (completely remove the message from the appliance)
- Mark as (this message will be learned by the bayesian engine as good or bad)
- Report as (report the message, as good in case of false positive or bad in case of false negative, to LibraCyber Labs to further analysis)
- Second Sight (get a Second Sight report from the LibraCyber Labs)
- View Body (view the email body directly from the ESG interface)
Information
In this tab are displayed general but detailed information about the message.
Overview
In the first section of the information tab, is shown an overview of the message. In this section are displayed less general email information such the Message ID, the email Size, the Scan Time and the Sender IP address.
Authentication
In the second section are shown the authentication results of the message In this section are shown the results of the SPF, DKIM and DMARC checks.
URIs
In the third section are shown the URIs contained in the email body.
By clicking on the magnifier icon at the end of each URI you can see the URI details and what action the URLSand engine performed. You are also able to search it in all the other messages on the appliance or search it on Virus Total.
Headers
In the fourth section of the tab are displayed most interesting email headers. You can analyze them better by displaying them in a raw format clicking on View raw headers.
Adaptive Trust Engine
In this section are displayed all information provided by the Adaptive Trust Engine (ATE) about this message.
AI analysis
The first section shows the result of the AI analysis of the message.
Relationship
In the second section are shown the Adaptive Trust Engine relationship information between all the email addresses involved in the email. The most important data is the Strength indicator. This bar indicates the amount of traffic between the sender and recipient. Generally speaking, a phishing or malicious email is less likely to be sent through a communication between two people having a good confidence.
Messages exchanged
In the third section is shown a chart representing how many messages landed on the appliance from this email address and domain.
Security Analysis
Here are displayed the scan results and the action taken by ESG to keep the user inbox safe.
Dangerous Checks
In this section are shown all the scan results and the action taken to sanitize potentially dangerous contents like URLs, attachments, hidden code etc...
Antispam Checks
In this section are shown the antispam scan results and block/welcome lists intervention. The most important value is the Spam Score. This score is the sum of all scores of the triggered rules shown by clicking View full spam report.
Data Loss Prevention
In this section are shown the Data Loss Prevention triggered rules. This rules prevents critical data sharing if not authorized.
Delivery
In this tab are shown all the delivery information of the message.
Received
In the upper section of the delivery tab is shown the message delivery trace. This trace is usually useful to debug delivery issues. For each hop are displayed common information such as the IP address, the Reverse hostname, the Country and the delivery Delay.
Deliveries
In the second section are shown all the delivery related information such as the DSN, the Relayed to IP address, the Relay Reply, the delivery Date and the delivery Delay.
Path map
In the third section is represented the email trace on a world map, in order to understand better where the email is coming from and where the delivery hops are.
Received Delay
In the last section are shown how many seconds the messages waited to leave the hop to reach the other. This tool is useful to know which host is slowing down the delivery process.